PMASA-2014-8

Summary

Description

With a crafted database, table or a primary/unique key column name it is possible to trigger an XSS when dropping a row from the table.
With a crafted column name it is possible to trigger an XSS in the ENUM editor dialog.
With a crafted variable name or a crafted value for unit field it is possible to trigger a self-XSS when adding a new chart in the monitor page.
With a crafted value for x-axis label it is possible to trigger a self-XSS in the query chart page.
With a crafted relation name it is possible to trigger an XSS in table relations page.

Severity

We consider these vulnerabilities to be non critical.

Mitigation factor

These vulnerabilities can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages.

Affected Versions

Versions 4.0.x (prior to 4.0.10.2), 4.1.x (prior to 4.1.14.3) and 4.2.x (prior to 4.2.7.1) are affected.

Solution

Upgrade to phpMyAdmin 4.0.10.2 or newer, or 4.1.14.3 or newer, or 4.2.7.1 or newer, or apply the patches listed below.

References

Thanks to Ashutosh Dhundhara for reporting the vulnerability in table relations page.